700-765 Sample Questions & Answers

Cisco Identity Services Engine (ISE) is the core component for network access control (NAC). It centralizes and automates policy enforcement based on user identity (who), device type (what), location (where), and time (when). ISE integrates with directory services like Active Directory to identify users, assign them to groups (students, faculty), and then enforce policies (e.g., VLAN assignment, downloadable ACLs) on network devices to grant the appropriate level of access.

The Malicious Activity Protection (MAP) engine is a behavioral protection component within Cisco Secure Endpoint. It focuses on detecting fileless malware and malicious behaviors, such as a legitimate process (powershell.exe) being used for malicious purposes (connecting to a C2 server). File Reputation would not flag this, as powershell.exe is a trusted file. Sandboxing analyzes files, not necessarily the behavior of already-running processes. The MAP engine specifically looks for these malicious behavioral patterns in real-time.

This scenario perfectly illustrates the challenge of a fragmented security architecture. When security tools do not integrate, they create data silos. This forces manual correlation, slows down response times (Mean Time to Respond - MTTR), and leads to alert fatigue, where important alerts can be missed. The core problem is the lack of integration between tools from multiple vendors, not necessarily the attack surface or staff shortages, although those are also challenges.

A core principle of Zero Trust is 'never trust, always verify.' This means trust is not granted for an entire session. Instead, it must be continuously reassessed. A device's security posture could change mid-session (e.g., malware infection), or user behavior could become anomalous. Therefore, verification must be an ongoing process, not a one-time event.

This solution directly addresses all five requirements. ISE provides identity-based NAC and enables TrustSec for micro-segmentation (Requirement 1 & 2). Secure Access by Duo ensures strong, posture-aware remote access (Requirement 4). Stealthwatch provides comprehensive network visibility, including encrypted traffic analysis (Requirement 3). Finally, SecureX provides the centralized platform for management and response (Requirement 5). This combination forms the foundation of a Cisco Zero Trust architecture for the workplace.

Cisco Secure Workload is specifically designed to address this use case. It discovers application dependencies and provides a consistent policy enforcement model across any infrastructure: bare metal, virtual machines, and containers, both on-premises and in the cloud. Its policies are tied to workload attributes, not network constructs like IP addresses, allowing security to follow the workload wherever it goes. While ACI and TrustSec are powerful segmentation tools, they are primarily focused on the network infrastructure layer, whereas Secure Workload is workload-centric and environment-agnostic.

Cisco Talos is the threat intelligence organization that performs research and generates intelligence feeds. Threat Intelligence Director (TID) is a feature within the Firepower Management Center (FMC) that acts as an intelligence aggregator. It consumes intelligence from Talos, but also from third-party feeds via standards like STIX/TAXII. TID then allows administrators to use this aggregated intelligence to create and enforce policies on Firepower devices, effectively operationalizing multiple intelligence sources.

Digitization, characterized by the adoption of mobile, cloud, and IoT, means that users, data, and applications are no longer confined within a well-defined network perimeter. This decentralization massively expands the attack surface—the sum of all possible entry points for an attacker. The traditional model of a strong perimeter with a trusted interior is no longer viable because the 'perimeter' is now everywhere, effectively dissolving it.

Cisco Stealthwatch is a network visibility and security analytics solution that is ideal for securing IoT devices. It operates by collecting and analyzing network telemetry (like NetFlow) from network infrastructure. This agentless approach allows it to baseline the normal behavior of all devices on the network, including those that cannot run agents. When a device deviates from its baseline, such as an IV pump communicating with an unusual destination, Stealthwatch flags it as an anomaly, alerting security teams to a potential compromise.

Verifying the user's identity, typically through strong multi-factor authentication (MFA), is a foundational step in establishing trusted access.

Alongside verifying the user, Zero Trust requires verifying the trustworthiness of the device they are using. This includes checking its security posture, such as whether the OS is patched, disk encryption is enabled, and security software is running.